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(54) Validation system 

(57) A validation system for validating an entity with 
whom a user intends to trade or exchange electronic in- 
formation, includes validation means operable to obtain 
status detail® of the entity from third party validation 
sources and indicator means operable to indicate the 
obtained status to the user substantially in real time. It 
also includes means operable to determine trie security 
of the communication medium between the user and the 
trading entity, the indicating means being operable to 
give an indication of the security of the communication 
substantially in real time. There are provided computer 



processing means operable to determine a trustworthi- 
ness indicator on the basis of one or more status details 
and/or communication security and to advise the user 
of the trustworthiness of the trading entity, The system 
can also generate a secure record of a transaction or 
exchange of electronic information with another entity 
including capture means operable to capture electronic 
data related to a transaction between a user and a trad- 
ing entity and lime stamp means operable to attach tim- 
ing information to the captured data. The secure record 
can be stored either by the user or at a remote location 
cont-olled by an independent party. 
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Description 

[000 1] The present invention relates to a validation 
system for use in commerce or other transaction cam sc- 
out with a remote trader, for example through the inter- 
net. 

[0002] This invention is related to the invention dis- 
closed In the applicant's earlier Internationa! Patent Ap- 
plication no. PCT/GBOO/0427. 
[0003] A problem with existing remote commercial 
transactions, such as purchases made through the In- 
ternet, is that the user (the buyer) has no guarantee of 
the trustworthiness of the company with which he/she 
wishes to trade. Similarly, the user Is not always made 
aware of the nature of the contract with the trader, such 
as whether the connection is secure, whether any other 
entity is party to the transaction and so on. 
[0OO4J international Patent Application no. PCT/ 
G 80 0/0427 discloses mechanisms for determining the 
trustworthiness of a trading entity. The present invention 
extends the concepts disclosed in that application and 
provides a user Interface. 

[0005] According to an aspect of the present Inven- 
tion, there is provided a validation system as specified 

in claim 1 . 

[0006j Preferably, the system includes means opera- 
ble to deiermihe the security of the communication me- 
dium Between the user and the trading entity, the Indi- 
cating means being operable to give an Indication otthe 
security of the communication substantially In real time, 
[0007] in the preferred embodiment, the system in- 
cludes processing means operable to determine a trust- 
worthiness indicator on the basis of one or more status 
details anchor communication security and to advise the 
user of the trustworthiness of the trading entity. 
[0003] in the preferred embodiment, the indicator is a 
visual indicator, for example provided on a computer 
monitor. The indicator may consist, for example, of a se- 
ries of colour signals each indicative of a level of trust- 
worthiness, preferably a "traffic light" type set of signals. 
[0009] According to another aspect of the present In- 
vention, there is provided a system for generating a se- 
cure record of a transaction or exchange of electronic 
information with another entity as specified in claim 12. 
[G010J Advantageously, the system Includes storage 
means for storing the secure record and/or printing 
means operable to print the secure record. In the pre- 
ferred embodiment, the secure record is preferably 
stored, either by the user or at a remote location con- 
trolled by a third party. The secure record can be ac- 
cessed when desired f rom the storage location. 
[00113 ih the preferred embodiment, the capture 
means Is preferably provided in a user computer and is 
operable tocapture screen displays re fating to the trans- 
action Advantageously, the system is also able to cap- 
ture data relating to the type of communication between 
the user and the trading entity. 
[0012J These aspects of the present invention can be 



combined together. 

{0013] An embodiment of the present invention is de- 
scribed below, by way of example only, with reference 
to the accompanying drawings, in which: 

5 

Figure 1 is an Illustration of an embodiment of vali- 
dation indicator; 

Figure 2 is an example of task bar Indicator; 

Figure 3 is an enlarged view of the validation irsdl- 
"> cator of Figure 1 ; 

Figure 4 Is a view of a detail window showing the 

details providingthe validation Indicator of Figure 1 ; 

Figures 5 to 7 show the three states of the validation 

•ndicator of Figure 1 ; 
fJ Figures 8 to 10 are examples of detail window for a 

three trustworthiness assessments; 

Figure 11 shows an embodiment of display giving 

details of a trading entity; 

Figure 1 2 shows displays giving details of the corn- 
s'* muntcatton link with the trading entity; 

Figures 13 to 1 8 show displays of details from a sin- 
gle website page generated by two different trading 
entitles: 

Figures 1 9 and 20 show respectively displays of 
25 websites having associations and not having asso- 
ciations with other trading entitles; 
Figure 21 shows how approved payment methods 
are displayed to the user; 

Figures 22 and 23 show windows which enable con- 
so figuration of the validation system by the user; and 
Figures 24 to 28 show the contents and retrieval of 
a secure record. 

[0014] The preferred embodiment Is described In the 

as context of a transaction carried out overthe internet, In 
particular a purchase by a consumer of a service or 
product. The details of the service or product and of the 
transaction Itself are carried out via Website pages and 
the transaction is substantially entirely electronic. 

*> 0)015] The following description Is based on a soft- 
ware system which Interacts with a web browser or 
which may incorporate a web browser. The skilled per- 
son will readily be able to produce the required software 
to implement the described functions so this w it not be 

4$ described in detail. 

[0016] The example given is based around a scenario 
of a purchaser procuring office supplies electronically, 
howeverthe teachings herein are, of course, much wid- 
er than this scenario. They apply to any election ic infor- 

50 mation exchange or transaction across the internet, h- 
tranets or other p ublic and private networKs. They equal- 
ly apply to any certificate based system, such as secure 
e-mail (S/MIME and PGP), IP-security, SET and other 
security protocols used in PKi systems. 

55 [0017] Thetwo mainfeatures of the validation system, 
the assessment of the security of a site and manage- 
ment of secure records, are described separately. 
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ASSESSMENT 
Basic Indicators 

[0018] The basic feature of the validation system is 
an Indicator, which in the case of a visual Indicator is 
preferably in the form of the "traffic light' indicator which 
provides an Indication of whether a web browser based 
access to a web site is considered to be secure [green), 
should be treated with caution (amber) or Is non-secure 
(red). The ru I os for exactly what forms a secure, caution 
or non-secu re assessment are based on an assessment 
policy set up by the web user. 
[001 9] Consider, for example, a purchaser for Buyer- 
Go using a web browserto look for a competitive source 
of office supplies for his/her company, identifies Setter- 
Co as a potential source. An account with that company 
may typically be set up by a process similar to that 
shown in Figure 1. 

[0020] The validation system gives the BuyarCo pur- 
chaser a simple indication of whether this the security 
of SellerCo of meets ail the requirements for his/her 
(SuyerCo) company policy 'or purchasing on-ilne 
through the green traffic light indicator 10. This traffic 
light indicator 10 can be placed in a convenient partot 
the user's windows environment. This indicator can ap- 
pear: 

a) In the task bar of the user's computer, as shown 
in Figure 1 , 

b) in a "minimised" control window as shown in Fig- 
ures 1 and 3: 

c) in a "maximised" control window as shown in Fig- 
ure 4 which Includes details about the assessment 
results obtained by the validation system to assist 
the user in deciding whether to proceed with the 
transaction, as described below. 

[0021] The traffic light Indicator of the preferred em- 
bodiment has three basic states: 

a) Green (see Figure 5): which indicates that all the 
user's policy requirements have been met and the 
entity is thus considered to be of highest trustwor- 
thiness; 

b) Amber (see Figure 6): which indicates that there 
are some aspects of the user's policy that have not 
been fully met but none which totally negate the se- 
curity for this access; 

c) Red (see Figure 7): which indicates that the site 
access is non-secure or the trading entity has a ma- 
jor trustworthiness weakness according to the us- 
er's set policy. 

[0G22] Depending on the policy of BuyerCo. the pos- 
sible actions of the purchaser based on the traffic light 
indicator could be: 



a) Qreen; the purchaser would be able to proceed 
with setting up an account with SellerCo knowing 
that the risk to the security of the information pro- 
vided is low; 

s b) Amber: the purchaser would not proceed with 
providing information for setting up an account to 
SellerCo until he/she has investigated further into 
the security of the access and the trustworthiness 
of SefferCo, possibly considering alternative suppll- 

«> ers. He/she would only proceed if he/she was cori- 
■Ident that the possible risk was worth the advan- 
tages of trading with SellerCo; and 
c) Red: the purchaser would not generally proceed 
with any actions which Involve exchanging commer- 

« cialty sensitive data with SellerCo (for example, pro- 
vide address or payment card details) on the page 
being displayed. 

Assessment Details 

so 

[0023] if the purchaser for BuyerCo feeis uncertain 
about the risk associated with a purchase, for example 
In the case of an amber rating, then further details of the 
assessment car be obtained by selecting the maxlm- 

23 tsed view of the assessment data window, an example 
of which is shown in Figure 8. The "rating" view of this 
window provides Information on the rating factors which 
give the site Its current assessment. The overs!! rating 
for the access to Sellerco.com is set to Green as all the 

so factors required in the assessment policy are present as 
displayed. 

[0024] If one of those factors Is considered to be a 
possible security risk, this Is Indicated by an amber in- 
dicator against that factor. Once any factor is amber the 

35 overall rating Is reduced to amber, as in Figure 9. 
[0025] Similarly, if one of the factors is considered to 
be a major risk to the security of the access this is indi- 
cated by a red indicator against that factor. Once any 
factor Is red the overall rating Is reduced to red, as In 

•to Figure to 

[0026] It will be apparentto the skilled person thatthls 
assessment Indication system provides a clear indica- 
tion of trading risk to the user, which is not provided for 
in prior art systems. Indeed prior art systems generally 

"3 fail to give the user any understanding of the risk impli- 
cations and are thus generally ignored or disabled as 
they tend to become an irritation. 
[0027] It Is Important to note that data of trading cer- 
tificates, membership to trade organisations, trading 

so and financial status are not obtained from the seller 
company but directly from the issuing authorities, such 
as the trade associations and government departments, 
and displayed in real time. The same applies to the com- 
munication assessment, that is the level of security of 

55 the communication between the user and the trading en- 
tity. Therefore, the user has immediate and clear access 
to up-to-date information on the trading entity and the 
communication fink and a clear assessment of the risks 
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involved. 

Site identification 

[0Q28J in addition to providing Information about the 
assessment rating, the system can also provide infor- 
mation about the site identity as authenticated through 
Ehe servers SSL server certificate, as shown in Figure 
1 1 . The purchaser can use this to gain assurance of the 
SelierCo is the registered company which operates this 
site, where it is located, what is the authenticated iden- 
tity of the server, as well ss any other information pro- 
vided in the certificate. 

Security 

[0029] Further detaiis of the security of certification 
authority that issued the certificate and strength of the 
cryptography employed in protecting access to the web 
site is provided under the security tab, as shown in Fig- 
ure 12, 

[0030] Another Important feature of th e preferred em- 
bodiment is its ability to warn and give details of com- 
munications wnich actually invoive not just one but two 
or more trading entities. More specifically, some web 
pages are formed of information provided by different 
sources. For example, Figure 13 shows a Web page 
which Includes advertisements from a trading entity 
Ads-Rus.com as well as information from trading entity 
SeilsrCoS. As shown in figure 13, the system provides 
two different detail windows, one for each trading entity 
and in these windows provides a separate set of rating 
and identity information for each entity 
[0G31] The rating information for main Seller4 site is 
as shown in Figure 14, while the rating information for 
the site providing the additional advertising information 
is as shown in Figure 15, In this example, there are some 
amber rated features for one of the sites, so the system 
set the overall rating to amber, which appears on the 
display 10 of Figure! andln the task bar indicator shown 
in Figure 2. 

[0032] Similarly, the system is designed to assess the 
security of the communication link not only direct with 
the user but also between the different trading entitles. 
In this manner, an Insecure link between two trading en- 
tities providing information on a common Web page is 
advised to the user. 

[0033] For example, in Figure 13, a web page is made 
up of information provided by different sources (trading 
entities), some secure and others non-secure. In the ex- 
ample, the general title bar is provided by a non-secure 
source. As can be seen in Figure 16, the system detects 
the communication links and displays to the user their 
status, in such a situation the rating Indicator for We 
communications changes to amber and indicates that 
the communications is "mixed secure / non-sacure". Al- 
so, an additional "non-secure" tab appears, which when 
selected show the names of the non-secure sites being 



accessed. 

[0034] By building a specialised web browser, rather 
than bufiding a monitoring too! around an existing web 
browser it Is possible to provide the user with an indica- 

s tlon of which parts of the Web page come from what 
source. Forexampie, each area of the page can be over- 
laid with a co I o u r relaiin g to whelh er th e so u roe is sec u re 
or non-secure, as shown in Figure 1 7. 
[0035] Commonly, when browsing the World Wide 

to Web for Information, the access to the sites is not se- 
cured. This can be acceptable to the user, provided that 
he/sne is aware that there Is no guarantee as to the au- 
thenticity of the data displayed and any input is not con- 
fidential. This can indicated by the red light indicator in 

is the system toolbar and by a detail window as shown in 
Figure 18. 

Associations 

20 [0036] An import factor in making a decision whether 
an organisation Is trustworthy Is not only the security of 
the access but alsowhetherltls recognised un der seme 
business association. For example, thane exist "trust 
schemes" for businesses operating over the internet 

25 which define codes of practice to which this business 
should conform. Onesuch acode of practice Is operated 
by Trust UK. Another situation where the association of 
an organisation may effect the selection for trading, is 
where business are accredited as being bona-flde for 

so that sector, for example the ACCA for chartered ac- 
countants in the UK and ABTA for travel agents, 
[0037] The system can provide such information ei- 
ther by holding a database of Information associated 
with the authenticated Identity of the site or by direct and 

as real time access to the trade association. This informa- 
tion on associations is used in the user display as shown 
in Figure 19. If a site is a member of a recognised as- 
sociation this is indicated by including the logo tor that 
association in the "associations" list provided by the ays- 

Jo tern for that site. Preferably, by clicking on that logo the 
usercan see on his/her web browserfurther information 
about that association (for example, its code of prac- 
tice). This could best be done by an automatic link to 
any website of that association, 

«s [0038] The system allows for the policy of the user's 
organisation (for example, BuyerCo in the scenario de- 
scribed) for a s;te to be fully acceptable (for example, 
rated green) that the SellerCo has lo be a member of 
the association "BUILD-UK". Where mambarahip of an 

so association is a policy requirement this can be i ncluded 
In She rating information (see Figure 1 9) . Thus, If the user 
accesses a site of atradlng entity which is not a member 
of the required association, it wiil be given an amber rat- 
ing, as shown in Figure 20. 

ss [003S] it is important to note that the preferred em- 
bodiment does not rely upon the trading entity itself for 
the data but rather it obtains the data from the authorised 
source, Therefore, a trading entity cannot masquerade 
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Itself as a member of an association and easily fool a 
normal user by providing the same look and feel of the 
authentication cheek. 

Payment Methods 

[0040] In a similar way to associations the system is 
designee! to provide the payment meth ods supported by 
a sits, as shown in Figure 21 . In the preferred embodi- 
ment, the authentication for the payment methods is not 
obtained from the trading entity but from the standard 
web security protocol (SSL) or from the credit compa- 
nies or banks. 

Other information 

[0041 J Other Information relating to an SSL authenti- 
cated site can be provided through the system Interface. 
This can include: 

a) legal information gtvlng specific legal advice 
about trading between the user's home country and 
the country of the site being accessed. This could 
include information on import duties, data protec- 
tion, consumer protection, a-commerce, legal rec- 
ognition of electronic signatures (as requlredfor se- 
cure records); 

b) reports and rating Information about the site from 
other users, user manager, independent organisa- 
tions; 

o) information on the number of accesses to a par- 
ticular site (derived from the number of assessment 
checKs made on a site counted by acentral server). 

Setting up Assessment Policy 

[0042] The system allows a user (or the manager of 
a group of users) to set up the policy rules tor the as- 
sessment rating for a site through a special manage- 
ment Interface. In the described scenario, the purchas- 
ing manager for BuyerCo could set up the policy rules 
through the settings interface of the system for his/her 
department. For example, the policy settings required 
for a Green rating could be as shown in Figure 22, for 
an Amber rating it could be as shown in Figure 23. 
[Q043J in the preferred embodiment, the Green rating 
is required to be at least as stringent that the Amber rat- 
ing {for example, if the country code must match URL 
for amber, then this must also be required for Green). 
The preferred system wili not save policies that break 
this rule. 

[0044] A site is rated Red >f It doss not meet the re- 
quirements of an Amber rating, 

impact of Caching 

[0048] The preferred embodiment provides a system 
which is a real time monitor of externa! access of a user's 



web browser. Every time the browser makes a external 
access to a Website over a network such the internet, 
this is detected by the system. This has the advantage 
of giving the user an indication of exactly what is ftap- 

& penhg when using the browser, Web browsers some- 
times keep a local copy ot information gathered when 
previously accessing a web site. The system preferably 
takes this into accou nt by keeping a cache of ail the ac- 
cesses when going to a particular site and displays this 

ff cached informaiion when returning to the site. 

[0046] When using the system a user can minimise 
the use of caching by his/her browser to ensure that the 
mas; up-to-date assessment information is available. 
This fs done by setting the option in his/her browser to 

« "check for a newer version of stored pages" for "every 
visit to the page". 

SECURE RECORDS 

20 single Records 

{0047] When making a purchase orcarrying out other 
commercial activities, on-line through the web browser 
there Is commonly a need to obtain evidence of the 
*s transaction. For example, when an on-line purchase is 
made, on compietion of the purchase request the sup- 
plier provides a final page specifying exactly what Is pur- 
chased, at what price, along with other terns and con- 
ditions relating to the purchase. This is commonly con- 
30 sidered to be a form of statement provided by the sup- 
plier of the goods to be supplied and typically establish- 
es the contract between the parties. 
(0040] In the preferred embodiment, the system ena- 
bles the userto obtain a copy of at least one Web page, 
35 such a3 statement for the supply of goods, along with 
the authentication data usedto establish a secure (SSl) 
connection to the supplier and other relevant evidence 
If accesses to several secure sites are involved in build- 
ing the Web page then the authentication data for all the 
40 accesses is collected, Also, basic {non-secure) ad- 
dressing Information is collected. 
{0049] The page(s) of Information can be collected in 
two forms, one a binary image of the data as displayed 
to the user, the other the structure data as sent by the 
45 web server (for example encoded in XML), 

[00SO] The collection o? a secure record is achieved 
In the preferred embodiment either by simple "click" on 
the "create record" button (as shown In Figure 24) or by 
acode in the page of information provided by the seller's 
so we p server which instructs the system automatically tc 
create a record. 

[0051 ] The secure record can either be stored on the 
user's machine or held on behalf of the user in a central 
database. Due to the potentially sensitive nature of the 
55 data held in secure records they are preferably encrypt- 
ed before storing. Additional clear-text attributes can be 
stored with each encrypted record to enable the appro- 
priate records to be easily selected for retrieval. The at- 
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tributes preferably used are: 

a) the llms that the record was created (as in the 

time-stamp), 

b) the name of the primary site associated with the 
record (as displayed in the address bar of the cur- 
rent browser), 

c) the title of the web page. 

|Q052) The collection of Information which forms the 
secure record is time-stamped and sealed with a digital 
signature provided by a trusted server. Tms set of Infor- 
mation provides strong evidence of the contract be- 
tween the parties, typically the intention of the supplier 
to provide the specified goods tor a particular price , The 
reasons are as follows: 

a) as each secure record Is time-stamped and 
signed by a trusted server, all the data in the record 
can be proven to have existed at the indicated time; 

b) as each secure record would Include authentica- 
tion data from the server, it can be proven that the 
buyer's (BuyerCo) browser had accessed the sail- 
er's (SelterCo) web server a short period before the 
time indicated in the time-stamp; 

o) as each secure record would include an Image 
of what the user had displayed In the browser being 
monitored, it can be proven that this page of Infor- 
mation was what was being viewed a short period 
bef ore the time indicated in the time-stamp; 

d) as each secure record can include the data as 
sent from the web server, It can be proven what data 
was received by the browser a short period before 
the time indicated in the itme-stamp; 

e) as each secure record would include Information 
on any other non-secure communications happen- 
ing a short per:od before the time indicated in the 
time-stamp, there is evidence of any other externa! 
factor which may have affected the data. 

[0CS3] When digital signature based security be- 
comes more widely deployed (for example with XM L sig- 
natures) the system can be enhanced to make use of 
this as an additional security mechanism by capturing 
the digital signature as part of the secure record. 

Sequence of Records 

[G054] A commercial transaction, such as the pur- 
chase of office equipment, can involve a sequence of 
interactions between two parties such as a buyer and a 
seller. An example o! the sequence of pages that may 
be captured for such a commercial transaction Is illus- 
trated in Figure 25, 

[0.055] As can be seen, the secure record facility en- 
ables the buyer to record ali the related web pages as 
he/she passes through the various stages of the com- 
mercial transaction. This may be done: 



a) by the user Indicating the start and end of a re- 
rated sequence, 

b) by the seller including a code In ail the web pages 
belonging to a related sequence, 

s c) by the user subsequently manually selecting 
records belonging to a sequence, 
d) by software programmed into the buyer system 
which has knowledge of the expected pattern of a 
related sequence. 

w 

Retrieval of Records 

[0056] To retrieve secure records from the local or re- 
mote store the user "cl icks" on the "retrieve record" bui- 

is ton. This gives the user a window as shown in Figure 
26 listing secure the records that have been created by 
the user. A particular secure record is selected for re- 
trieval by pointing at the required entry (as in Figure 27) 
This results in that entry being retrieved from storage, 

so decrypted and displayed in the form of a thumbprint Im- 
age atong with a token representing the authentication 
data associated with that Image. 
{0057] Further detalis cf this record can be obtained 
by clicking on "View Detalis" which provides detalis ot 

25 the secure record, including: 

a) The binary authentication token (Figure 28); 

b) The image collected (Figures 29 and 30). 

30 {0056} Extensions to this facility will provide the capa- 
bility to organise the secure records into folders for ex- 
ample to hold sequences of related records. 
{0059} The disclosures In British patent application 
no. 0113695.2, from which this application claims prlor- 

as ay, and In the abstract accompanying this application 
are Incorporated herein by reference. 



Claims 

40 

1. A validation system for validating an entity with 
whom a user intends to trade or exchange electron- 
ic information, including computerised validation 
means operable to obtain status details of the entity 

« from third party validation sources, and indicator 
means operable to indicate the obtained status to 
the user substantially in raa! time. 

2. A system according to claim 1, including means ap- 
se arable to determine the security of the communica- 
tion medium between the user and the trading en- 
tity, the indicating means being operable to glvs an 
indication of the security of the communication sub- 
stantially in real time. 

3. A system according to claim 1 or 2, including com- 
puter processing means operable to determine a 
trustworthiness indicator on the basis of one or 
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more status details anchor communication security 
and to advise the user of the trustworthiness of the 
trading entity. 

4. A system according to any preceding claim, where- 5 
in trie Indicator is a visual indicator. 

5. A system according to any preceding claim, where- 
in the indicator provides a series of different signals 
each indicative of a ievel of trustworthiness. to 



16. A system according to any one of claims 1 2 to 1 5. 
wherein the capture means is provided in a user 
computer and is operable to capture screen dis- 
plays relating to the transaction. 

17. A system according to claim 16, wherein the cap- 
ture means is able to capture data relating to the 
type of communication between the user and the 
trading entity. 



6. A system according to any preceding claim, opera- 
ble io generate a secure record of a transaction or 
exchange of electronic information with another en- 
tity including capture means operable to capture »s 
electronic date related to a transaction between a 
user and a trading entity and time stamp means op- 
erable to attach timing information to the captured 
data. 

20 

7. A system according to claim 6, Including storage 
means for storing the secure record. 

8. A system according to claim 7, wherein the storing 
means Is located at a user location or at a remote ?s 
location. 



9. A system according to claim 6, 7 or 8, Including 
printing means operable to print the secure record. 

tO, A system according to any one of claims 6 to 9, 
wherein the capture means is provided in a user 
computer and Is operable to capture screen dis- 
plays relating to the transaction, 

35 

11. A system according to claim 10, wherein the cap- 
ture means is able to capture data relating to the 
type of communication between the user and the 
trading entity. 

40 

12. A system for generating a secure record of a trans- 
action or exchange of electronic information with 
another entity Including capture means operable to 
capture electronic data related to a transaction be- 
tween a user and a trading entity and time stamp 
means operable to attach timing information to the 
captured data. 

13. A system according to claim 12, including storage 
means for storing the secure record. so 

14. A system according to claim 13, wherein the stor- 
age means is located at a user location or at a re- 
mote location. 

55 

15. A system according to claim 12, 13 or 1 4, including 
printing means operable to prim the secure record. 
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